about web.config and set authorization by roles

I have this web.config file and file named CheckOut.aspx in the same folder.
<?xml version="1.0" encoding="utf-8"?> <configuration>   <system.web>     <authorization>       <allow roles="operator" />       <allow roles="administrator" />       <deny users="?" />     </authorization>   </system.web> </configuration>
When I try to access CheckOut without being logged in I'm redirected to my login page.If I for example assign role administrator to my user name tony and try again without being logged in I'm still redirected to my login page. Is that how it works. I thought that if I have the role administrator I could access the page CheckOut without being looged in.
So can somebody explain ...